WC_API_Authentication::check_oauth_timestamp_and_nonce() │ private │ WC 1.0

Verify that the timestamp and nonce provided with the request are valid. This prevents replay attacks where an attacker could attempt to re-send an intercepted request at a later time.

• A timestamp is valid if it is within 15 minutes of now
• A nonce is valid if it has not been used within the last 15 minutes

Method of the class: WC_API_Authentication{}

No Hooks.

Return

null. Nothing.

Usage

// private - for code of main (parent) class only
$result = $this->check_oauth_timestamp_and_nonce( $keys, $timestamp, $nonce );

$keys(array) (required)

-

$timestamp(int) (required)

the unix timestamp for when the request was made

$nonce(string) (required)

a unique (for the given user) 32 alphanumeric string, consumer-generated

WC_API_Authentication::check_oauth_timestamp_and_nonce() WC API Authentication::check oauth timestamp and nonce code ^{WC 7.7.0}

private function check_oauth_timestamp_and_nonce( $keys, $timestamp, $nonce ) {
	global $wpdb;

	$valid_window = 15 * 60; // 15 minute window

	if ( ( $timestamp < time() - $valid_window ) || ( $timestamp > time() + $valid_window ) ) {
		throw new Exception( __( 'Invalid timestamp.', 'woocommerce' ) );
	}

	$used_nonces = maybe_unserialize( $keys['nonces'] );

	if ( empty( $used_nonces ) ) {
		$used_nonces = array();
	}

	if ( in_array( $nonce, $used_nonces ) ) {
		throw new Exception( __( 'Invalid nonce - nonce has already been used.', 'woocommerce' ), 401 );
	}

	$used_nonces[ $timestamp ] = $nonce;

	// Remove expired nonces
	foreach ( $used_nonces as $nonce_timestamp => $nonce ) {
		if ( $nonce_timestamp < ( time() - $valid_window ) ) {
			unset( $used_nonces[ $nonce_timestamp ] );
		}
	}

	$used_nonces = maybe_serialize( $used_nonces );

	$wpdb->update(
		$wpdb->prefix . 'woocommerce_api_keys',
		array( 'nonces' => $used_nonces ),
		array( 'key_id' => $keys['key_id'] ),
		array( '%s' ),
		array( '%d' )
	);
}